Skip to content

feat: add Falco security provider#5563

Open
zekebawt wants to merge 5 commits intokeephq:mainfrom
zekebawt:feat/falco-provider
Open

feat: add Falco security provider#5563
zekebawt wants to merge 5 commits intokeephq:mainfrom
zekebawt:feat/falco-provider

Conversation

@zekebawt
Copy link

@zekebawt zekebawt commented Feb 4, 2026

Summary

This PR adds a new provider for Falco - the open-source runtime security engine for containers, Kubernetes, and hosts.

Closes #5024

Features

  • Webhook-based integration - Receives security alerts from Falco via Falcosidekick or native HTTP output
  • Full priority support - Maps all Falco priority levels (Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug) to Keep severities
  • Rich context extraction - Extracts Kubernetes (namespace, pod, node), container (name, ID, image), and process context from Falco output_fields
  • CNCF project support - Falco is a CNCF incubating project, this expands Keep's cloud-native security coverage

Implementation Details

  • Follows the existing webhook provider pattern (similar to Checkmk, SkyWalking providers)
  • Comprehensive test coverage with 10 test cases
  • Includes setup documentation for both Falcosidekick and native Falco HTTP output

Testing

  • Provider syntax validated
  • Unit tests created for all alert formatting scenarios
  • Severity mapping tested for all priority levels
  • Kubernetes/container context extraction verified

- Add _get_incident_activities() to fetch work notes and comments
- Add _add_incident_activity() to push activities to ServiceNow
- Add sync_incident_activities() for bidirectional sync
- Implements keephq#3379
- Extend ServiceNow provider to support BaseIncidentProvider
- Add _get_incidents() and _format_incident() methods for incident sync
- Add _get_auth_and_headers() helper for cleaner API requests
- Implement bidirectional activity sync between ServiceNow and Keep
- Add PROVIDER_METHODS for workflow integration
- Map ServiceNow states/severity to Keep incident status/severity

Closes keephq#3379
Implements webhook-based provider for WeChat Work (WeCom) group bots.
This enables Keep users in Asia to send alerts to WeChat groups.

Features:
- Send text messages to WeChat Work group chats
- Send markdown formatted messages
- Support for @ALL and specific user mentions
- Support for mobile number mentions

Closes keephq#5443
Add webhook-based provider for Apache SkyWalking APM platform.

Features:
- Receive alerts from SkyWalking alarm webhooks
- Parse service, endpoint, and instance-level alerts
- Map SkyWalking severity levels to Keep severity
- Extract tags from alarm payload
- Comprehensive test coverage (10 test cases)

Closes keephq#5487
Implements webhook-based provider for Falco runtime security engine.

Features:
- Parse Falco/Falcosidekick webhook payloads
- Support all Falco priority levels (Emergency to Debug)
- Extract Kubernetes, container, and process context from output_fields
- Map Falco priorities to Keep severity levels
- Include comprehensive test coverage (10 test cases)

Closes keephq#5024
@vercel
Copy link

vercel bot commented Feb 4, 2026

@zekebawt is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

@dosubot dosubot bot added the size:XXL This PR changes 1000+ lines, ignoring generated files. label Feb 4, 2026
@greptile-apps
Copy link
Contributor

greptile-apps bot commented Feb 4, 2026

Target branch is not in the allowed branches list.

@dosubot dosubot bot added the Provider Providers related issues label Feb 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Provider Providers related issues size:XXL This PR changes 1000+ lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🔌 Provider]: Falco

1 participant